P.S: I write browser exploits (mostly FF, I'm not pro enough to do Chrome!). Usually use-after-free. Myself and my colleagues still browse with JS on. BTW, NoScript bypass is do-able.
SVG is another good source of bugs that comes to mind.
I don't think FF code quality is particularly worse than other browsers. Part of the problem is that it is simply a very large very public project. Some of the code is very old. Mainly though, they have been a bit slow to implement architectural features (e.g. privilege separation / sandboxing) which would improve resilience.